23andMe files for bankruptcy, putting customers’ genetic data at risk

The genetic testing company 23andMe has begun Chapter 11 bankruptcy proceedings, alarming regulators and privacy advocates who are warning customers to delete genetic information retained by the company. 

Chapter 11 is a bankruptcy process focused on company reorganization. 23andMe said on Sunday it intends to put itself up for sale following the proceedings.

The company also announced that CEO Anne Wojcicki, who co-founded the firm in 2006, is resigning from her role. Joe Selsavage, the current chief financial and accounting officer, will succeed her as interim CEO. 

The firm has been in financial distress for some time as interest in its at-home, saliva-based DNA tests has ebbed. In October 2023 it suffered a massive data breach causing major reputational damage and exposing the genetic information of more than six million people. 

Much of that data ended up on the dark web, 23andMe has said.

Last September, the firm agreed to pay $30 million in a class action lawsuit which consolidated dozens of other suits.

“After a thorough evaluation of strategic alternatives, we have determined that a court-supervised sale process is the best path forward to maximize the value of the business,” Mark Jensen, chair of the board of directors, said in a statement. “We believe in the value of our people and our assets.”

The firm pledged not to change its policies around customer data management and access, saying buyers will have to agree to “comply with applicable law with respect to treatment of customer data.”

California Attorney General Rob Bonta warned consumers to delete their data as soon as possible. The company is not subject to the Health Insurance Portability and Accountability Act (HIPAA), which protects patient data in many health care settings. 

While 23andMe’s privacy policy prohibits it from sharing its data with insurers or law enforcement there is nothing to stop a buyer from changing that practice. Police frequently mine other ancestry firms’ troves of genetic information looking for DNA to link to crimes.

The company’s privacy policy asserts that in the case of bankruptcy, acquisition, merger, sale or reorganization, customers’ personal data may be “accessed, sold or transferred.” 

A hodgepodge of state privacy laws and lack of a federal law means millions of Americans’ genetic data could be sold and made vulnerable in any number of ways, experts warned.

Wojcicki herself has reportedly told investors that she views customer data as a financial asset, saying it has value for pharmaceutical companies.

A 23andMe spokesperson did not immediately respond to a request for comment. Privacy advocates highlighted the vulnerability of customers’ genetic data.

“23andMe’s most valuable asset is likely its trove of highly sensitive consumer personal data, including genetic data,” said Suzanne Bernstein, counsel at the Electronic Privacy Information Center. 

On Friday, shortly after the firm publicly reported its dire financial condition in security filings, California’s attorney general issued a press release warning consumers to erase their genetic data. 

The release included detailed instructions on how to download and delete genetic data.

Consumers can eliminate their 23andMe test samples by removing permissions under the preferences tab, the press release said, and can reverse previous consent for their genetic data to be used in research.